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Re: Notice Concerning Potential Disclosure of Personal Identifying Information 

To Whom It May Concern: 

The Investor Protection Unit of the Delaware Department of Justice (the “IPU”) recently 
became aware of an inadvertent disclosure of personal information housed in the Central 
Registration Depository and Investment Adviser Registration Depository (collectively, the 
“Registration Systems”) maintained by the Financial Industry Regulatory Authority (“FINRA”). 
While we have reason to believe your agency already has been made aware of this issue, we 
write to inform you of the nature of the inadvertent disclosure, the steps the IPU has taken 
relating to the incident, and the number of residents in your state affected by the same. 

Applicants for securities industry registration in Delaware file and submit information 
and disclosures that are housed in the Registration Systems. Between August 2012 and February 
2015, pursuant to one or more Freedom of Information Act (“FOIA”) request(s), the IPU 
provided reports (the “Reports”) from the Registration Systems to journalists, academics, 
financial industry database/marketing contact firms, and other requesters. The Reports, which 
were generated by FINRA at Delaware’s request for use in responding to FOIA requests, 
provided information gathered from Forms U4 and U5 for all broker-dealer-agents and 
investment adviser representatives registered in Delaware at the time the Reports were generated. 

The Reports included one (or more) docket/case number(s) (the “Case Numbers”) the 
affected individuals supplied on a judgment, lien, or bankruptcy disclosure reporting page 
(“DRP”). We became aware that, for certain individuals, one or more of these Case Numbers 
reflected personal information such as a social security number, bank account number, or other 
personal identification number. Although affected individuals may have indicated on the 
pertinent DRP(s) that the Case Number(s) contained personal information, until recently the 
Registration Systems’ software did not suppress case numbers that may have included this 
indication. The IPU requested for the Reports to exclude social security numbers and other 
personal information, and the Reports did exclude or mask social security numbers and other 





peisoJisA information entered in fields specifically soliciting that information. The IPU was 
unaware that personal information remained embedded in the case/docket field. 

In light of the potential for inadvertent disclosure of personal information for some 
registrants, the Reports are being remediated and have been made temporarily unavailable. The 
IPU and other agencies are currently working with the Registration Systems administrator, 
FINRA, to revamp the Reports and otherwise review the content of the registration fonns in an 
effort to prevent further inadvertent public disclosure of personal information. 

The IPU takes very seriously the privacy and security of applicants for securities 
registration. We began investigating this incident as soon as we learned of it, and we are 
continuing to work aggressively to resolve it. We already have instructed the recipients of the 
Reports to return and/or destroy any inadvertently disclosed private infonnation, to take 
additional appropriate steps to ensure the security of the information, and to confirm their 
compliance with these directives. 

3 residents of Indiana have been affected by the inadvertent disclosure. On or about 
March 23,2015, the IPU sent letters notifying these individuals of nature of the inadvertent 
disclosure and the steps taken by the IPU in response. The letter, an example of which is 
enclosed, advises recipients to be vigilant with their financial accounts and provides contact 
information for the major credit reporting agencies, the Federal Trade Commission, and the 
Office of the Attorney General in your state. 

If you have any additional questions or concerns about the circumstances of this 
disclosure and the IPU’s response, you may contact Jeff Drobish, Deputy Attorney General, at 
302-577-8424, or ieff.drobish@state.de.us . 
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